Written and maintained by CASRAI Editorial Board
Last updated
Doxy.me is a browser-based, HIPAA-compliant synchronous telemedicine and virtual care platform built on the open W3C WebRTC (Web Real-Time Communication) standard that enables clinicians and clinical research coordinators to conduct encrypted audio-video encounters without requiring patients to download a native mobile application or create an account. By combining a persistent personalized room URL (doxy.me/RoomName), an isolated Virtual Waiting Room, point-to-point DTLS-SRTP media encryption, and an executable HIPAA Business Associate Agreement (BAA) across all subscription tiers, Doxy.me supports outpatient telepsychiatry, primary care, and remote informed-consent visits.
Ask CASRAI · free to try
Ask about this guide — your first 2 questions are free.
Suggested question: “What is Doxy.me and what is it used for?”
What Is Doxy.me and Does Doxy.me Have an App?
What is Doxy.me used for, and does Doxy.me have an app? Although patients and clinicians frequently search for a ‘Doxy.me application’ or ‘Doxy.me app download’ in mobile app stores, Doxy.me is engineered specifically as a zero-download web application. Both the clinician dashboard and the patient check-in interface run natively inside standard HTML5/WebRTC browsers—including Google Chrome, Apple Safari (iOS/macOS), Mozilla Firefox, and Microsoft Edge—across desktops, tablets, and smartphones.
Eliminating client-side software installation solves two common operational bottlenecks in ambulatory telehealth and decentralized clinical trials:
- Zero Patient Account Registration or App Store Friction: Patients do not need to register a username, remember a password, or grant permanent mobile OS app permissions; they open a single HTTPS link sent via SMS, email, or an EHR patient portal.
- Ephemeral Zero-Footprint PHI Handling: Because no native client stores local call history or cached chat databases on the patient’s smartphone, session data is cleared from browser memory as soon as the tab closes.
How Does Doxy.me Work? (Architecture, Encryption, and Pre-Call Test)
In health informatics and HIPAA compliance checklist evaluations, Doxy.me’s technical architecture separates signaling, media transport, and clinical queue management into distinct layers:
| Architectural Layer | Technical Standard / Protocol | Clinical & Security Function |
|---|---|---|
| Signaling & Waiting Room | TLS 1.2 / 1.3 (HTTPS / WSS) over AWS infrastructure | Authenticates the clinician dashboard, registers patient check-in events into an isolated per-patient Virtual Waiting Room, and negotiates session metadata. |
| Audio/Video Media Transport | W3C WebRTC with DTLS-SRTP (Datagram Transport Layer Security for Secure Real-time Transport Protocol) | Encrypts real-time audio and video streams in transit; uses STUN (Session Traversal Utilities for NAT) for peer-to-peer routing and encrypted TURN relays when hospital firewalls block direct UDP traffic. |
| Data at Rest & Ephemeral Policy | AES-256 server-side encryption; zero persistent media storage | Encrypts clinician account configurations and BAA records at rest; audio, video, and in-call text messages are never recorded or stored on Doxy.me servers by default. |
| Pre-Call Diagnostics (Pre-Call Test) | Built-in WebRTC hardware & network probe | Verifies camera permissions, microphone input gain, speaker output, browser compatibility, and STUN/TURN bitrate and packet jitter before the clinician admits the patient. |
Step-by-Step Clinical and Research Encounter Workflow
- Clinician Room Provisioning & BAA Execution: The provider or research institution signs up, executes the electronic HIPAA Business Associate Agreement inside account settings, and configures a static waiting room URL.
- Patient Check-In & Pre-Call Test: The patient clicks the room link, enters their first/last name to enter the private Virtual Waiting Room (where they cannot see other waiting patients), and runs the automated Doxy.me pre-call test to verify camera, microphone, and network stability.
- Provider Dashboard Queue & Admission: From the Doxy.me dashboard, the clinician views real-time waiting times, sends one-way waiting-room announcements if running behind schedule, and clicks the patient’s queue entry to initiate the encrypted two-way WebRTC session.
- In-Session Clinical Tools (Clinic & Professional Tiers): During the encounter, clinicians can use screen sharing (to review lab results or imaging), multi-party group calling (to include medical interpreters, caregivers, or co-investigators), photo capture, file transfer, and EHR iframe embedding while documenting synchronous telehealth encounters billed with CPT Modifier 95 or legacy HCPCS Modifiers GT and G0.
Is Doxy.me Free, and How Do Subscription Tiers Compare?
When evaluating HIPAA-aware vs. HIPAA-compliant telehealth tools under the HIPAA Privacy Rule, Doxy.me is unusual in providing an executable HIPAA BAA on its free tier alongside paid clinical tiers:
- Free Tier: Includes a personalized room URL, Virtual Waiting Room, unlimited 1-on-1 standard-definition video sessions, browser-based access, and a signed HIPAA Business Associate Agreement (BAA).
- Professional & Clinic Tiers: Add HD video and audio modes, audio-only call fallback, group calling (up to 10–20 participants), screen sharing, photo capture, document/file transfer, custom branding/subdomains, waiting room passcode locks, Single Sign-On (SSO), and centralized clinic room management with usage analytics.
Troubleshooting: Pre-Call Camera/Microphone Checks and Status Verification
When users query ‘is Doxy.me down’ or experience one-way audio/video during a session, clinical IT teams follow a four-point diagnostic protocol:
- Check Platform Status (`status.doxy.me`): Verify real-time operational uptime for signaling servers, TURN media relays, and notification gateways on the official Doxy.me status page.
- Run the Built-In Pre-Call Test: Use the pre-call diagnostic widget to confirm that the operating system and browser (Chrome or Safari on iOS; Chrome on Android/Windows/macOS) have granted camera and microphone permissions to `https://doxy.me`.
- Verify Hospital Firewall UDP/TCP Ports: Institutional networks must allow outbound UDP port `3478` and TCP/TLS port `443` so WebRTC STUN/TURN media packets are not dropped by deep-packet inspection proxies.
- Release Hardware Locks from Background Apps: Close competing video conferencing processes (such as Zoom, Microsoft Teams, or Webex) that hold an exclusive OS driver lock on the webcam.
Frequently Asked Questions
What is Doxy.me and what is it used for?
Doxy.me is a browser-based, HIPAA-compliant telemedicine platform used by physicians, behavioral health therapists, and clinical researchers to conduct encrypted live video visits. It features a personalized URL, a virtual waiting room, and an included HIPAA Business Associate Agreement without requiring patients to download an app.
Does Doxy.me have an app?
No standalone mobile or desktop app download is required. Doxy.me runs directly inside standard WebRTC-compatible web browsers (Chrome, Safari, Firefox, and Edge) on smartphones, tablets, and computers when a patient clicks the provider’s room link.
Is Doxy.me free and HIPAA compliant?
Yes. Doxy.me offers a permanently free tier for individual clinicians that includes unlimited 1-on-1 browser-based video visits, a virtual waiting room, DTLS-SRTP encryption, zero persistent recording of audio/video streams, and a signed HIPAA Business Associate Agreement (BAA).
Sources
- Doxy.me Official Documentation: Security, Encryption, and HIPAA/GDPR/SOC 2 Compliance Overview (
https://doxy.me/en/security/). - World Wide Web Consortium (W3C) & Internet Engineering Task Force (IETF): WebRTC 1.0: Real-Time Communication Between Browsers and RFC 5764 (DTLS-SRTP).
- U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR): HIPAA Security Rule Technical Safeguards (45 CFR § 164.312) and Telehealth Guidance.
